diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index cbd2c84..a5fc558 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -15,7 +15,7 @@ concurrency: env: # The engine ref ktor-guard pins (lockstep 4.3.3; settings.gradle.kts builds it from # source). Bump this and the settings comment together with a facade upgrade. - GUARD_CORE_JVM_REF: db716ec0a038fa3dd0a145211bf6a1f18c178d03 + GUARD_CORE_JVM_REF: 6cde4afd08a0172c5f6a41eb8e29ec754288782e jobs: build: diff --git a/.github/workflows/code-ql.yml b/.github/workflows/code-ql.yml index f7ed4d2..8aa81e1 100644 --- a/.github/workflows/code-ql.yml +++ b/.github/workflows/code-ql.yml @@ -11,7 +11,7 @@ permissions: {} env: # The engine ref ktor-guard pins (mirrors ci.yml; settings.gradle.kts builds the engine # from source, so the composite build needs the sibling checkout during analysis). - GUARD_CORE_JVM_REF: db716ec0a038fa3dd0a145211bf6a1f18c178d03 + GUARD_CORE_JVM_REF: 6cde4afd08a0172c5f6a41eb8e29ec754288782e jobs: code-ql: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 46e6728..60cc1d1 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -26,7 +26,7 @@ permissions: {} env: # The engine ref ktor-guard pins (lockstep 4.3.3; settings.gradle.kts builds it from # source). Bump this and the settings comment together with a facade upgrade. - GUARD_CORE_JVM_REF: db716ec0a038fa3dd0a145211bf6a1f18c178d03 + GUARD_CORE_JVM_REF: 6cde4afd08a0172c5f6a41eb8e29ec754288782e jobs: pre-flight: diff --git a/CHANGELOG.md b/CHANGELOG.md index 7a5b754..3fb9f9b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,7 @@ All notable changes to this project are documented in this file. The format foll ### Changed +- The pinned guard-core-jvm engine ref moves to 6cde4af (guard-core-jvm master, the 4.4.0 line), so CI tests the engine code that ships in 4.4.0. It adds the empty-whitelist fix (an empty global whitelist now means no whitelist, guard-core-jvm#57) on top of db716ec. The lockstep `guardCore` version stays 4.3.3 until 4.4.0 is on Maven Central. - The pinned guard-core-jvm engine ref moves to db716ec, which carries the detection scan budget, semantic header handling and cookie split (guard-core-jvm#53) and the dynamic rules overlay (guard-core-jvm#55). - The pinned guard-core-jvm engine ref moves to 9067b7b, which fixes the agent telemetry wiring (Guard-Core/guard-core-jvm#48): an injected guard-agent-jvm handler was never added to the engine composite, so it was never started and received no events, and metrics travelled as events. A new `InjectedAgentWiringTest` covers the injected handler end to end (start, events, metrics, stop). - Dependencies: netty is pinned to 4.1.139.Final through `platform(io.netty:netty-bom)`. lettuce-core 6.8.2 declares netty 4.1.125, which carries twelve advisories fixed by 4.1.137 at the latest. The pin is declared here as well as in the guard-core-jvm facade, so this lockfile stays the same whichever engine revision the build resolves. All twelve netty osv-scanner suppressions are removed. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index e6f9249..14cf50c 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -23,7 +23,7 @@ pinned ref: ```bash git clone https://github.com/Guard-Core/guard-core-jvm ../guard-core-jvm -git -C ../guard-core-jvm checkout db716ec +git -C ../guard-core-jvm checkout 6cde4af ./gradlew build # detekt + ktfmt check + tests ``` diff --git a/docs/examples.md b/docs/examples.md index af6da38..0ce13a2 100644 --- a/docs/examples.md +++ b/docs/examples.md @@ -8,7 +8,7 @@ for blocked requests. git clone https://github.com/Guard-Core/ktor-guard.git cd ktor-guard git clone https://github.com/Guard-Core/guard-core-jvm.git guard-core-jvm -git -C guard-core-jvm checkout db716ec +git -C guard-core-jvm checkout 6cde4af docker run -d -p 6379:6379 redis:7-alpine ./gradlew :examples:demo-ktor:run ``` diff --git a/docs/installation.md b/docs/installation.md index a0ad94e..60daae2 100644 --- a/docs/installation.md +++ b/docs/installation.md @@ -24,7 +24,7 @@ packages stay `com.guardcore.*`. ## Engine dependency (includeBuild + dependency substitution) Consumers resolve the engine artifact `com.guard-core:guard-core` from Maven Central. This repository's own build pins the engine from source instead: CI and -local builds check out `Guard-Core/guard-core-jvm` at the pinned ref `db716ec` +local builds check out `Guard-Core/guard-core-jvm` at the pinned ref `6cde4af` as the sibling directory `./guard-core-jvm`, and `settings.gradle.kts` substitutes the declared coordinates with the included build's projects. The declared dependency coordinates stay `com.guard-core:guard-core:4.3.3` @@ -32,7 +32,7 @@ declared dependency coordinates stay `com.guard-core:guard-core:4.3.3` ```bash git clone https://github.com/Guard-Core/guard-core-jvm.git guard-core-jvm -git -C guard-core-jvm checkout db716ec +git -C guard-core-jvm checkout 6cde4af ./gradlew build ``` diff --git a/settings.gradle.kts b/settings.gradle.kts index 0d6ecf1..44840cd 100644 --- a/settings.gradle.kts +++ b/settings.gradle.kts @@ -25,7 +25,7 @@ pluginManagement { // included build until the artifacts publish to Maven Central. // // Layout: the engine checkout sits as a sibling of this repo. CI checks it out -// with actions/checkout (repository: Guard-Core/guard-core-jvm, ref: db716ec, +// with actions/checkout (repository: Guard-Core/guard-core-jvm, ref: 6cde4af, // path: guard-core-jvm); locally clone it with // git clone https://github.com/Guard-Core/guard-core-jvm ../guard-core-jvm // ---------------------------------------------------------------------------